ORIGINAL ARTICLE

Tom Kontogiannis

Integration of task networks and cognitive user models using colouredPetri nets and its application to job design for safety and productivity

Received: 6 May 2004 / Revised: 7 February 2005 / Accepted: 5 June 2005 / Published online: 9 November 2005� Springer-Verlag London Limited

Abstract Changes of task demands due to unforeseenevents and technological changes can cause variations injob design such as modifications to job procedures andtask allocation. Failure to adapt to job design variationscan lead to human errors that may have severe conse-quences for system safety. Existing techniques for taskmodelling cannot adequately model how task networkscan be adapted to changing work conditions and taskdemands. Therefore, there is a need to integrate tasknetworks with cognitive user models that indicate howoperators process information, make decisions, or copewith suspended tasks and errors. The work describedhere presents a tool for integrating task and cognitivemodels using coloured Petri nets. The cognitive usermodel comprises two modules of attention management(selective and divided attention), a module of memorymanagement of suspended tasks and a module of workorganization. Performance Shaping Factors (e.g.,workload, fatigue and mental-tracking load) are calcu-lated at any point in time to take into account thecontext of work (e.g., competing activities, errors andsuspended tasks). Different types of human error can bemodelled for rule-based behaviours required in proced-uralized work environments. Simulation analysis andformal analysis techniques can be applied to processcontrol tasks to verify job procedures, workload man-agement strategies and task allocation schemes in re-sponse to technological changes and unfamiliar events.

Keywords Task networks Æ Cognitive modelling ÆHuman reliability Æ Job design Æ Safety Æ ColouredPetri nets

1 Introduction

Many reviews of near miss and incident analysis inprocess control have identified a common pattern ofoperational problems that are related to how peopleadapt to variations in job design caused by unforeseenevents and technological changes (Kletz 1991; Hollnagel1993; Embrey et al. 1994; Kjellen 2000). Operationalproblems may include machine failures, unavailability oftools, operation of new or unfamiliar equipment,encountering high levels of workload, carrying out thesame job with fewer people, and so forth. In such cases,operators may have to modify their goal priorities, jobprocedures, allocation of tasks and use of tools or re-sources. These modifications may initially lead tounsuccessful actions as they are often carried out undertime pressure and frequent interruptions. The ability ofjob design to adapt to variations in ordinary practiceand recover from early unsuccessful actions will affectnot only productivity but also system safety.

Matching job requirements to human capabilities hasbeen the concern of task analysis for several decades anda range of techniques have been developed in the domainof industrial ergonomics (Kirwan and Ainsworth 1992;Stanton and Young 1999). Task analysis techniqueshave been successfully used to describe operator goals,allocation of tasks and scheduling of tasks to optimizeman-machine interaction. However, task analysis de-scribes ‘how the job should be done’ under a set of well-defined conditions of the work environment. In thissense, it runs into difficulties in cases where technologicalchanges and unanticipated events require variationsfrom ordinary practice. The effects of job variations,such as modifications in procedures and changes in taskallocation, are usually examined at a later stage with theuse of a complementary human error analysis. Anotherconcern with traditional task analysis is the design ofnew jobs for which little information exists for thestaffing levels and the required scheduling of tasks andresources. It appears that new techniques are needed

T. KontogiannisDepartment of Production Engineering and Management,Technical University of Crete, University Campus, Chania,Crete 73100, GreeceE-mail: konto@dpem.tuc.gr

Cogn Tech Work (2005) 7: 241–261DOI 10.1007/s10111-005-0010-z

that would examine systematically variations in existingjobs as well as model requirements of new job designs.

The aim of the work described here is to develop atool for generating task networks and modelling rule-based behaviour in work environments characterized byfrequent variations in procedures and task allocation.The output of task analysis and additional data are usedto specify a task network which models the flow ofinformation, the utilization of resources and the controlof tasks. This task model is integrated with a cognitiveuser model that examines strategies for changing goalpriorities, coping with suspended tasks, managingworkload, and allocating resources to people. Hence, thecognitive user model can be used to adapt an ordinarytask network to the changing conditions of the workenvironment. An error taxonomy (Hollnagel 1993) hasbeen used to model the consequences of human errorand the potential for error recovery. A computer simu-lation tool has been developed in order to cope with thelarge amount of data required to carry out an extensiveanalysis of tasks in proceduralized work environmentsand to run several combinations of work conditions thatmay lead to human errors due to inefficient strategies inmanaging workload and task allocation. In this way, thedesign of existing and new jobs can be verified in termsof cognitive user strategies and standard operatingprocedures.

Previous approaches to task modelling have tendedto focus mainly on computer representations of operatortasks and plans, without any elaboration on the cogni-tive strategies employed by human operators. Taskmodelling tools, such as MicroSaint (Laughery andCorker 1997) and GOMS (John and Kieras 1996),provide a useful basis for examining the effects of severalpolicies for task allocation and scheduling on the designof procedures but do not incorporate any user models toindicate how operators process information, makedecisions, or cope with suspended tasks and errors. Inthe context of human-computer interaction, task mod-elling tools - such as ConcurTaskTrees (Mori et al.2002), TOBOLA (Uhr 2003), TOOD (Abed et al. 2003)and DIANE+ (Tarby and Barthet 1996) - have beendeveloped to design the user interface but they providelimited facilities for modelling cognitive user strategies.

The benefits of integrating task models and cognitiveuser models are clear. First, the way that operatorsadapt to variations in job procedures imposed by tech-nological changes can be studied better with cognitiveuser models that address attention management anddecision-making with regard to changing work condi-tions, goal priorities, and scheduling requirements. Sec-ondly, coping with new events, task interruptions andunsuccessful attempts requires human memory modelsof how people keep a mental track of their activities andtheir own progress. Thirdly, cognitive user models pro-vide a good basis for estimating the dynamic effects ofperformance shaping factors (PSF) on human reliability(e.g., models of divided attention have been used tomodel workload). Finally, the consequences of human

error can be better understood when cognitive usermodels specify how these errors arose in the first place.

In view of these benefits, an interest has been wit-nessed increasingly in recent years in tools that integratetask models with cognitive user models. In the context ofhuman computer interaction, for instance, Lebiere et al.(2002) integrated a task modelling tool (i.e., IMPRINT)with a widely acceptable cognitive model of humanmemory and learning (i.e., ACT-R). In the area of air-craft maintenance, Cacciabue et al. (2003) developed asimulator tool that integrated task modelling with a usermodel that estimated PSF dynamically. Other develop-ments in human reliability focused on formal models ofuser behaviour that predicted human errors in the con-text of air traffic control (Lindsay and Connelly 2002).Finally, a generic purpose tool was developed by Hendyand Farrell (1997) that integrated Perceptual ControlTheory with task networks for a wide variety of appli-cations.

Petri nets have been used in several applications as acommon technique for the modelling of tasks, users andtechnical systems. An example is the work of Palanqueand Bastide (1997) and Lacaze et al. (2002) which inte-grated a formal representation of the system with theHuman Processor Model of Card et al. (1983). Otherstudies have used Petri nets modelling to reason aboutusers’ mental models and their expectations over thecourse of an interaction (Rauterberg 1993; Moher andDirda 1995). In recent years, Petri nets provided thebasis for the analysis of human interactions with com-plex industrial systems. In the nuclear power sector, forinstance, Yoshikawa et al. (1997) used Petri nets to de-velop a cognitive simulator model of how operatorsdiagnose accident sequences. A study by Stutz and On-ken (2001) provided useful insights into the adaptationof normative pilot models based on Petri nets with theuse of case-based reasoning while Blom et al. (2000)looked into aspects of situation assessment in air trafficcontrol systems using Dynamic Stochastic Petri Nets.Finally, in the defense sector Handley and Levis (2003)used coloured Petri nets (CPN) to integrate decision-making and operational planning in command andcontrol tasks.

The modelling approach that is proposed in this workis based on a Petri net representation of human activi-ties, tools, and organizational roles. Petri nets are castboth in a graphical form and a mathematical formalism.The graphical form of Petri nets helps to visualize statetransitions in cognitive processes where both serial andparallel processing can be mixed. Although most of themodelling work can be done in the Petri nets graph, themathematical foundation provides the basis for using avariety of formal analysis techniques. Formal analysistechniques can be built into software packages in orderto examine several structural and dynamic properties ofPetri nets. Formal analysis uses reachability graphs andlinear algebra to examine whether a task network con-tains deadlocks, livelocks (i.e., never-ending tasks),dangling tasks that do not contribute to the goal, dead

242

tasks that never occur, and tasks that result in lack ofsynchronization. The reachability graph can be used toexamine certain behavioural properties (i.e., liveness)and identify routes of tasks that may lead to ‘hazardous’states (Levenson and Stolzy 1987). Linear algebra canenable analysts to prove certain structural properties interms of place and transition invariants. For instance,place invariants may prove that a task can be found in acertain number of states or that certain tools are usedthroughout a job. On the other hand, transition invari-ants can be used to examine how a system can bedecomposed into subsystems that perform dedicatedfunctions, such as an autonomous cyclic processing ofdata and products. Finally, Petri nets provide a commonlanguage for modelling both the technical system andthe human element. In this way, research done in theformal analysis of manufacturing systems may be ex-plored in the modelling of man-machine systems. Theproposed modelling framework is based on colouredPetri nets CPN implemented on the technical platformDesignCPN (Jensen 1997a, b).

The paper is structured as follows. First, a frameworkis proposed for integrating task networks with cognitiveuser models which presents the flow of decisions anddata as well as the interactions between the constituentparts. The following section focuses on the theoreticalstructure adopted for representing human performancein the context of existing cognitive modelling ap-proaches. The computer implementation of the tasknetworks and cognitive models in terms of CPN is then

described in detail. A case study is presented to illustratethe capabilities of the simulation analysis tool in thecontext of a process control task. State space analysis ofthe CPN model is not examined as this was beyond thescope of the current work. Finally, the capabilities andlimitations of the simulation tool are discussed in theconcluding section.

2 A framework for integrating task and user modelswith coloured Petri nets (CPN)

The proposed framework consists of a task model ornetwork that specifies the organization of tasks requiredto achieve certain goals and a cognitive user model thatspecifies how operators select and prioritize tasks, howthey allocate tasks according to their preferences and jobdemands, and how they keep mental track of suspendedor failed tasks. An executive mechanism is used thatmonitors external events and makes decisions aboutchanges in task processing. The task network, the usermodel and the executive mechanism are being executedin parallel (Fig. 1).

A key construct in this framework is tasks—i.e., thebuilding blocks of operations required to achieve certaingoals. Tasks can be scheduled and organized in differentways to form higher-order operations as well as they canbe served by different operators and material resources.Tasks are characterized by certain attributes associatedwith their temporal order such as, pre-conditions, task

TASK MODEL

Decide

TASKTEMPLATE

Monitor

EXECUTIVE MECHANISM

Goals and Tasks

Recall Assign

ExecutePrioritize

COGNITIVE USER MODEL

ENVIRONMENT

GL

OB

AL

C

OM

MU

NIC

AT

ION

PL

AC

ES

Fig. 1 A proposed frameworkfor integrating task models andcognitive user models.Monitoring and decision-making are modelled separatelyin the executive mechanism

243

durations, task priorities and primary or contingentoperators. There are also additional task attributes re-lated to particular aspects of the cognitive user model.For instance, tasks are rated in terms of the degree towhich they rely on perceptual, cognitive and motorchannels in order to estimate the workload of operatorswhen attention is divided between multiple tasks. Othertask attributes may be related to the external cues thatremind operators to resume suspended tasks in thememory module of the user model. In this sense, a largeamount of data is required as different task attributesare associated with different aspects of the task networkand the cognitive user model.

The task model is a network, or organization oftasks, specifying the normative sequence of tasks asdescribed in the operating procedures. Alternative se-quences can be tested in the task model in order to findout the most efficient ones, or to examine the conse-quences of human error in planning activities. Infor-mation from the task model is passed on to the cognitiveuser model through a task template which transformsthe graphical form of a task into a token, or mark, thatenters the user model for further processing (Fig. 1).Petri nets enforce a ‘point-to-point’ or local communi-cation framework which, on some occasions, may re-strict the management of dynamic changes to data andtasks. For this reason, a small number of global fusionplaces were created to enable some degree of globalcommunication between Petri nets modules.

The user model comprises four cognitive models thataddress issues of task selection, mental tracking (e.g.,recalling suspended tasks), operator assignment andexecution of tasks. Human errors are modelled either atthe stage of planning sequences in the task model, or atthe stage of execution in the user model. The conse-quences of errors are specified in the execution moduleand are spread throughout the task network. Theinteractions between task network, cognitive user modeland executive mechanism are best seen in the data anddecision flowchart (Fig. 2). The paths taken through thisflowchart describe the data and decisions made by sev-eral CPN models in a way that is easier to communicate.The decision blocks of the flowchart correspond tosmaller CPN models that collect data, make decisionsand produce outputs. Ovals depict queues of tasks thatare locally accessible (i.e., local communication) whilecylinders depict databases holding dynamic informationabout the state of tasks that are globally accessible (i.e.,global communication).

The executive mechanism initiates the task networkwhich sends new tasks to the cognitive user modelaccording to a specified plan or sequence of tasks. Thetasks are seen as discrete units that may be skipped orforwarded for processing in the user model. A list ofcandidate tasks is first formed that includes tasks beingsuspended in the Suspended_Tasks_Memory place. Arecall/shed algorithm is used to determine tasks that maybe forgotten due to an excessive load in mental tracking.Candidate tasks are prioritized and join a list of selected

tasks for further processing or await selection for longerperiods of time. Prioritization of tasks is based onanother algorithm derived from a model of selectiveattention. Selected tasks are assigned to operatorsaccording to the allocation rules and operator prefer-ences specified in a work organization model. Parallelprocessing of tasks is affected by the workload ofoperators as calculated by a fourth algorithm based on amodel of divided attention. Ongoing tasks that may beexecuted in parallel can join the list of active tasks forexecution. Six workload-management strategies areimplemented to cope with task allocation and the pro-cessed tasks are subsequently executed in the user model.

The output of the cognitive user model (i.e., correctactions and human errors) is sent to two databasesholding information about the state of current tasks andsuspended tasks. Several performance problems can bemodelled including omissions, mistiming, interruptionsand delays. Commission errors are modelled separatelyas planning errors in the task model. Tracking errors canalso be considered when suspended tasks are shed as aresult of high load in mental tracking. Errors can haveconsequences on the performance of tasks and maycause side-effects to other tasks performed earlier in thesequence. The decision model monitors the work envi-ronment and determines whether the current goal shouldbe interrupted or not, in favour of others. In addition,the decision model can initiate the recovery of tasks thathave been upset, shed, or failed earlier.

3 Cognitive modelling

In recent years, there has been a growing effort indeveloping computer models of human performance assummarized in several revisions of the literature (e.g.,Cacciabue 1998; Pew and Mavor 1998; Zachary et al.1998). Some studies have focused on detailed represen-tations of human cognition while others emphasized theinteraction between cognition and work environment.This time-dependent interaction between cognition andwork is very important for the study of human reliabilityin complex work environments. The selection of modelsof attention and memory in this work was guided by theextent to which candidate models made reference to thecontext of work (e.g., current tasks, competitor tasks,suspended tasks and failed tasks) and included taskcharacteristics that could be changed as part of the job-redesign process. Some of the selected models of atten-tion and memory had been simplified to enable quanti-fication of the man-machine interaction in a way that wasappropriate to the modelling language. Petri nets is a toolthat has been used primarily for modelling technicalsystems, however, there is some potential to be exploredfor modelling human performance as well (Blom et al.2000; Schlick et al. 2002; Handley and Levis 2003).

The cognitive user model includes a work organiza-tion module for assigning tasks to operators accordingto their capabilities, preferences and system allocation

244

Cor

rect

plan

s

Err

oneo

uspl

ans

TA

SK

MO

DE

L

Nex

t tas

ksbl

ocke

d

Nex

t tas

ksac

cess

ible

Sid

eef

fect

s?

DE

CIS

ION

MA

KIN

G

N

Y

Beg

inta

sk?

N

Sel

ecte

d(p

riorit

ized

)ta

sks

Can

dida

teta

sks

Y

TA

SK

TE

MP

LA

TE

Inte

rrup

ted

&co

mpl

eted

goa

ls

Initi

ated

&re

sum

ed g

oals

MO

NIT

OR

ING

EX

EC

UT

IVE

ME

CH

AN

ISM

Sus

pend

edT

asks

Mem

ory

Upd

ate

Upd

ate

Sel

ect

task

?

N

Y

Rec

all

task

?

N

She

d ta

sks

(tra

ckin

ger

rors

)

Y

Par

alle

lpr

oces

sing

?(r

oles

/wor

kloa

d)N

Act

ive

task

s

Y

Om

issi

ons,

Mis

timin

gs,

Inte

rrup

tions

,D

elay

s

N

Exe

cute

task

corr

ectly

?

Cor

rect

actio

ns

CO

GN

ITIV

EU

SE

R M

OD

EL

Upd

ate

Tas

kS

tate

Sta

ck

Rec

over

edta

sks

Y

Upd

ate

Dec

isio

nbl

ocks

Loca

l tas

kqu

eues

Glo

bal

task

data

base

sK

EY

S

EX

EC

UT

ION

Fig. 2 A flowchart showing the flow of data and decisions in the proposed framework

245

rules. Monitoring and decision-making are two cogni-tive processes that have not been adequately developedin the present version of the simulation tool. As theywere not based on formal models of cognition, they werenot included in the cognitive user model. However, theywere considered in the executive mechanism that runparallel to the modules of attention and memorymanagement.

3.1 Attention management

The purpose of the attention management module is toschedule tasks to be performed, taking into accountcertain priorities, task constrains and interferences atany point in time. This module determines whether atask is performed on demand, interrupted, resumed orpostponed. The task network generates new tasks thatmay compete for attention with tasks actively running,or tasks being temporarily suspended. When a new taskarrives in the cognitive user model, a list of candidatetasks is made from new tasks and suspended tasks thatcould be possibly resumed. Selective attention is a dy-namic process that considers several priorities forselecting which tasks to consider first. Although taskshave their own default priorities, the selective attentionmodule computes a priority index that takes into ac-count the context of work at any point in time (e.g.,other competing tasks).

The following computing algorithm has been adaptedfrom previous work by Freed (1998, 2000):

P ¼ ICþXn

i¼1 pi � cið Þ ð1Þ

whereP is the priority index for a new or suspended task,

– IC is the interruption cost associated with interruptingor deferring a task,

– i = 1 ..., n potential consequences as a result ofdeferring a task,

– pi is the probability of incurring the ith consequence,and

– ci is the cost of the ith consequence

The interruption cost (IC in Eq. 1) is a numerical valuethat incorporates the cost of interrupting or deferring atask. It is associated with maintaining tools and resourcesin appropriate states during the interruption interval andre-establishing preconditions in order to reconsider thetask at a later stage. The second term of Eq. (1) refers tothe risk of incurring an adverse consequence as a result ofinterrupting or deferring a task. The idea of a deadline,after which undesirable consequences may occur, is acentral feature of any approach to prioritization (Freed2000). Deferring a task from selection may be associatedwith several deadlines, or consequences, that have dif-ferent probabilities of occurrence. This probability is afunction of several factors including, (1) the timeremaining until a consequence is ensued, (2) the duration

of the task, (3) the times the task has been interrupted orsuspended in the past, and (4) the characteristics ofcurrent competitor tasks. The last factor is the mostdifficult to calculate because it requires predicting whatcompetitor tasks may exist at a second or third attemptto select a task that has been deferred in the past. Thisability to ‘project into the future’ and predict likelycompetitor tasks is not elaborated in the present modulewhich considers competitor tasks in the current attemptonly. The product of probability and cost is the risk of aconsequence that is summed up with other consequences.This sum is added to the interruption cost in order tocalculate a priority index for a new or suspended task.The ‘selective attention’ module selects the task with thehigher priority index which is added to the list of tasksawaiting further processing (see list of selected tasks inFig.2). Tasks with the same priority are scheduledaccording to their originally scheduled start time or leasttask duration.

A second attention mechanism operates on the se-lected or prioritized tasks in order to keep operatorworkload within acceptable tolerance limits. Tasks thatshare the same information processing channels will in-crease the workload and, hence, compete for processingtime. A ‘divided attention’ module operates in order tocalculate interference levels arising from parallel pro-cessing of tasks. A workload index is used to estimate theinterference level on the basis of the Multiple ResourceModel (MRM) of Wickens et al. (1988). Each task israted in terms of the demands on the perceptual, cog-nitive and motor channels and the combined effects areused in computing a workload index:

WT ¼Xm

i¼1

Xn

t¼1at;i� �

þXm

i¼1ci

Xn�1

t¼1

Xn

s¼tþ1at;i þ as;i� �

ð2Þ

Where

– WT is the instantaneous operator workload at time T,– i = 1, ..., m resource channels,– t,s= 1, ..., n competing tasks,– a t,i is the loading on channel i to perform task t,– a s,i is the loading on channel i to perform task s, and– ci is the conflict between tasks in sharing channel i

The first term of Eq. (2) is the first order workloadcomponent and represents an aggregate of concurrenttask demands at a given point in time. The secondorder component represents conflict due to taskssharing the same information channels. It calculates thedemand values within each channel and multiplies theresulting sums by a conflict value corresponding to theinterference level in the channel in question. This isdone for each channel separately and the results ofintra-conflict are summed up for all information-pro-cessing channels. Inter-conflict between channels is notconsidered in this module but it is possible to calculateon the basis of the algorithm suggested by North andRiley (1989).

246

The scheduling of tasks is influenced by the strategiesthat operators use to manage their workload at differentpoints in time. This module includes the following strat-egies that can be triggered when an operator’s workloadexceeds a pre-defined threshold value (Lockett 1997):

A. A penalty is incurred in terms of reduced accuracy orspeed of execution

B. The new task is not started by any other operatorwhich is referred to as ‘deferring or skipping the task’

C. The new task is performed in serial rather than inparallel to ongoing tasks

D. The new task is reallocated to another operator whois less busy

E. An ongoing task is reallocated to a new operatorF. An ongoing task is interrupted in favour of pro-

cessing the new task

Strategies for managing operator workload can bedefined by forming combinations of the six basic strat-egies. Therefore, the scheduling of tasks will be deter-mined by the momentary workload of operators and theselected strategy for managing workload. Workload issupposed to follow an exponentially decay function andits accumulated effects are taken into account in an indexof fatigue. In this sense, workload and fatigue can beviewed as two PSF that impact upon the likelihood ofhuman error.

3.2 Memory management

A temporary task queue is generated and regulatedaccording to a model of human memory in order tomanage the large number of new candidate tasks, sus-pended tasks, tasks awaiting processing (i.e., the list ofselected tasks) and ongoing tasks (i.e., the list of activetasks). The activation-based model of memory (Altmanand Trafton 2002; Lovett et al. 2000) has been adaptedwhich views retrieval of suspended tasks from memoryas a function of the ‘base-level activation’ specific to thetask (internal cueing) and the ‘external activation’ re-ceived from task cues in the work environment (externalcueing). The ‘base-level activation’ depends on theimportance of the task and its frequency of rehearsal inmemory. On the other hand, external cueing depends onthe number and strength of task cues that may remindoperators of a suspended task pending execution. Hence,each suspended task acquires some degree of activationin the working memory and the task can be recalledwhen its activation level exceeds a threshold. A tentativealgorithm for modelling the activation level of sus-pended tasks has been developed by building on earliermodels of Lovett et al. (2000). The proposed algorithmfor calculating the activation level (A) of suspendedtasks is as follows:

A ¼ FCþ TA

n

� �� 1� Wcð Þ

Wmax�Xm

i¼1

Si

mð3Þ

where,

– A is the activation level of a suspended task,– FC is the cost of forgetting a suspended task,– TA is the total activation level of attention spreading

to n tasks,– n is the number of tasks in the focus of attention (i.e.,

new tasks, suspended tasks, prioritized tasks andongoing tasks),

– wc is the current workload of operator,– wmax is the maximum workload value of operator,– si is the strength of recall of the ith external cue, and,– i = 1 ... m external cues for a suspended task.

The first term of Eq. (3) refers to the ‘base-level acti-vation’ of a suspended task and has a numerical valuecorresponding to its importance or cost of forgetting.The second term describes the dynamics of externalcueing in human memory. The total activation level (TA)is spread equally over all tasks and external cues that arecurrently in the focus of attention. In general, a task willbe more active, the more strongly related it is to a set ofexternal cues (i.e., the sum of si of cues) which corre-sponds to data-driven processing. Top–down processingcan be modelled by the portion of attention allocated toeach task when other tasks compete for attention. Tomodel top-down processing, the TA is divided by thenumber of tasks (n) in the focus of attention (i.e., newtasks, suspended tasks, selected tasks and ongoing tasks);it is also assumed that only a potion of total activationwill be available to all tasks due to the current workloadof operators. From a cognitive science perspective, it isvery interesting to examine the relative values of the twoterms of Eq. (3) since a high value of ‘base-level activa-tion’ will render the activation level (A) insensitive to thecontext of work. In other words, an important task has ahigh ‘base-level activation’ (i.e., it is frequently re-hearsed) and does not need many external cues to remindoperators when to reconsider this task in future.

The number of tasks in the focus of attention (n) canbe seen as an index of the memory load in tracking thestate of various tasks and remembering their implica-tions for action. It is likely that the type of task and itsimplication for action will affect memory load in track-ing progress. In the current version of the tool, thenumber of tasks in the temporary queue (n) is used as asimple index of mental tracking load. It is worth notingthat the workload index refers to ongoing tasks that arecurrently running and does not include suspended tasksand selected tasks awaiting processing. Therefore, theindex of mental tracking load can be seen as a separateperformance shaping factors (PSF).

3.3 Work organization

To model the performance of a crew of operators it isnecessary to have a module of work organization thatspecifies how the work is allocated to different operators

247

according to certain allocation rules, operator capabili-ties and workload levels. Allocation rules may be specificto a few tasks (e.g., two tasks should be done by thesame operator), or may concern generic strategies fortask allocation. For instance, a global rule may specifythat an operator is not allowed to do more than fourtasks when someone else did nothing during the sameperiod of time. Therefore, it is possible to have a com-pliance score for each operator describing the extent towhich his or her performance complies to a local orglobal rule. The capabilities of operators can be takeninto account by incorporating their accuracy and speedof performing a task in an algorithm that computes anassignment score (R) for each operator at a point wherea decision must be made on how to allocate a task.

The following algorithm has been proposed to com-pute the assignment score for each candidate operator atany point in time:

R ¼ P � A=Dð Þ �Yn

i¼1Ci ð4Þ

where,

– R is the assignment score for an operator,– P is the priority value of a specific task,– A is the task accuracy val ue achieved by an operator– D is the task duration value achieved by an operator– i = 1, ..., n rules for task allocation, and,– Ci is the operator compliance score with the ith

allocation rule.

As argued before, tasks can have certain priorityvalues that change over time depending on the contextof work. Equation (4) uses a simpler expression for thepriority value of tasks by considering only the defaultpriority of tasks (i.e., the standard cost of interruption asshown in Eq. 1). The compliance score of each operatorto each allocation rule can be taken by the expressionCi=1 – Penalty(i), where a penalty value is assigned toany violations of the rule. The algorithm in Eq. (4) se-lects the operator with the highest assignment score asthe most suitable candidate to perform a specific task. Ifthe selected operator had a high workload level, then thenext operator is selected with the lower assignmentscore.

4 CPN modelling

4.1 Basic concepts

Coloured Petri nets (Jensen 1997a, b) have been chosenas a candidate for modelling because they providefacilities for hierarchical and timed descriptions, com-munication of ‘data structures’ (i.e., Coloured tokens),simulation of tasks, and formal analysis of reachabilityor occurrence graphs. Task analysis can be carried outby decomposing tasks into hierarchies of operations andplans in a manner similar to hierarchical task analysis

(Shepherd 2001). For this reason, a classificationof plans has been developed for Petri net-baseddescriptions of human plans and task sequences(Kontogiannis 2003). Structural and dynamic propertiesof the task network are investigated with the use ofoccurrence graphs that are automatically constructed bythe DesignCPN software package. The simulationfacility of DesignCPN is used for collecting performancedata, such as time to perform tasks, idle time for oper-ators and machines, product throughput, and operatorworkload. In addition, task simulation allows analyststo explore a variety of questions related to aspects ofplan implementation. Some of those questions includethe following: are there enough resources (humanoperators and tools) to achieve a plan? How long will ittake to achieve a plan? Are there any periods wheresome operators are overloaded or waiting idle? Whatdeadlocks should be avoided to ensure that the goal isachieved? What activities should be done in parallel tospeed-up a task without creating deadlocks? Thesequestions guided the current work in modelling taskactivities with Petri nets.

Formally, the structure of a Petri net is a bipartitedirected graph G = (P,T,A), where P = {p1, p2, p3, ...,pn} is a finite set of places, T = {t1, t2, t3, ..., tn} is afinite set of transitions, and A (P · T) [ (T · P) is a setof directed arcs. The set of input places of a transition (t)is given by I(t) = {p|(p,t) 2 A} and the set of outputplaces is given by O(t) = {p|(t,p) 2 A}. A high-level Petrinet graph comprises the following elements:

– A Net graph. It consists of nodes (i.e., places andtransitions) and arcs connecting places to transitions.

– Places. They are passive elements that can describeinitial and end states of tasks, preconditions, andbuffers for holding tools and resources. Places arerepresented as circles or ovals.

– Tokens. Tokes are ‘data items’ that reside in placesand move throughout the network. Each place canhold several tokens of the same data type which areusually depicted as small and solid circles.

– Arc annotations. Arcs are inscribed with expressionsthat may comprise constants, variables and functions.The expressions are evaluated by substituting valuesfor the variables. Inscriptions on transitions (i.e.,guards) evaluate to Boolean values.

– Transitions. They are active elements that can be usedfor representing tasks, transportation of resources,routing of tasks and processing of events. Manysoftware packages allow designers to write codes in-side the transitions to enable control of the flow oftokens and evaluation of arc annotations.

– Declarations. They are statements regarding the datatypes held by places, the types of variables, and thespecification of several functions.

A CPN model of the system describes the states inwhich the system may be found and the transitions be-tween these states. The state of the system corresponds

248

to the distribution of tokens to all places at any point intime. When a transition is activated or fired, tokens areconsumed in the input places and new tokens are createdin the output places, according to the rules specified inthe arcs or the transition codes. A CPN model has aninitial state and may have several end states which rep-resent desired and undesired outputs of the model. Therecan be several hundred or thousand paths between theinitial state and the end states and this set of pathsconstitutes the state space of the CPN model. Thesoftware tool DesignCPN contains formal analysismethods which can be used to analyse the state space ofthe model and find efficient and problematic pathsbetween inputs and outputs. A simulation correspondsto a single path of the state space and cannot be trustedto search all possible paths. Formal analysis techniquesallow the analysis of a CPN model without the need toconduct simulation runs. However, if one is interested inthe statistical significance of certain variables in a model,simulation runs will then be necessary.

4.2 The task model

The task model describes the normative sequence oftasks which can be adapted to the changing work con-ditions in two modes: (1) online adaptation via the cog-nitive user model and (2) offline adaptation by changingthe structure of the task model. For instance, adjustingthe start or duration of tasks, changing the orderof tasks, and switching between serial and parallel

processing can be made in the on-line mode. On theother hand, carrying out new sequences of tasks canonly be done off-line because this requires some changesin the organization of the task network. The reason forthe off-line adaptation is that the task model was cast asa tree graph (Fig. 3) in order to keep it compatible withexisting methods of task analysis. Kontogiannis (2003)developed a Petri net notation of fifteen plans or se-quences of tasks that could match the plans encounteredin hierarchical task analysis (examples can be seen in

CHOICE PLANS

SEQUENTIAL PLANS DISCRETIONARY PLANS

Discretionary inclusive plans: Do both A and B, in any order, or concurrently

Explicit choices: Choose A or B depending on rules

Fixed sequences: Do A and B in specified order

[x=a]

A

x

x

B

AT

B

A B

[x=b]

Prioritized sequences: Do both A and B giving priority to A

Discretionary exclusive plans: Do either A or B, in any order

Deferred choices: Choose A or B depending on availability of triggers A and B

A

secondary place

B

Trigger AA

secondaryplace

B

A

End B

start

Trigger B

B

End A

Fig. 4 A Petri net notation of different types of task sequences (Kontogiannis 2003)

Task 7

Goal 2

Task 11

Task 12

Goal 3

Task 15Task 6

Goal 1

Task 1

End

Start

Fig. 3 An example of a task model showing a hierarchical jobdescription in terms of goals and tasks

249

Fig. 4). In fact, task modelling allows a more precisedefinition of plans than task analysis does, in a notationthat is also executable. For a thorough presentation ofworkflow patterns and their transformation to Petrinets, the reader is referred to van der Aalst and Hofstede(2002).

Tasks are represented as transitions (white boxes inFig. 3) with input and output places whilst other tran-sitions may be used to create different task routings thatcorrespond to particular plans of action (black boxes inFig. 3). Places hold information about task attributesand task triggers (circles or ovals in Fig. 3) while tokenscirculate this information throughout the network (smallsolid black circles in Fig 3). Task sequences are orga-nized so that they form different ‘wholes’ correspondingto operator goals; hence, a hierarchical organization ofgoals is produced (Fig. 3). Some CPN models have useda ‘tokens as tasks’ perspective because this enablesdynamic insertion and deletion of tasks (e.g., Handleyet al. 1999; Petrucci et al. 2002); however, this archi-tecture may lose the visualization of task sequences thatis shown in the ‘transitions as tasks’ perspective (Figs. 3,4). In order to increase the degree of on-line adaptation,the proposed framework transforms the tasks intotokens at a later stage, as they enter the cognitive usermodel.

This is achieved with the use of a task template (asshown in Fig. 5) which decomposes further each ‘tasktransition’ into a set of places and transitions. Therouting of the token from the task model towards theuser model is determined by the code segments in tran-sitions Begin_Task and End_Task. At this stage, the‘task token’ contains information about the identity ofthe task and the goal only, whereas additional attributesare considered in the cognitive user model. A task can befound at eight states that have implications for furtherprocessing (e.g., default, started, done, interrupted, de-

ferred, failed, upset and shed). Information about statesand other task attributes is held in a global-fusion placeTask_State_List that is updated by the user model.

Goals can be interrupted and resumed by the execu-tive mechanism which monitors the state of the technicalsystem and makes decisions about goal planning.Interrupting a goal is indicated by putting its flag downand this results in suspending all uncompleted tasks (seearc with inscription flag=Down). It is worth noting thatresumption of interrupted goals differs from recovery oferrors (i.e., failed, forgotten or upset tasks). Goals areresumed by inserting a new token in the task modelwhich enters all task templates but bypasses those thathave been done in the past (see arc with inscriptions=Done). On the other hand, error recovery is doneseparately for each task without the need to re-activatethe whole group of tasks that comprise a certain goal.Hence, error recovery is modelled by allowing a failed,forgotten or upset task to enter the ‘task template’ of thespecific task via the global-fusion place Recovered_Tasksfrom the decision model of the executive mechanism.Error consequences are considered in the user modelwhich updates accordingly the information held in placeTask_State_List and the information carried by thevariable impact to transition End_Task. If the impact ofan error prevents further processing of the remainingtasks (i.e., impact = Locked), then the task token isconsumed in this transition (i.e., condition pass=onevaluates to false) and this part of the model reaches anend state.

4.3 The executive mechanism

The executive mechanism basically consists of themonitoring and decision-making transitions and runs inparallel to the task and user models (Fig. 6). A closed

USER MODEL

TSL

Task State List

Begin Task

If flag=Up & s<>Done then 1`(g,t)

tsl tsl

(g,id)

RT

DECISION MODEL

Recovered Tasks

[t=id] ID

Task Identity

if pass=on then 1`g else empty

g

tg Data

TASK MODEL

Task Entered

t Task Processed

Data

End Task [t=t_out]

(g,t_out, s,flag,impact)

tsl

tsl

If flag=Down or s=Done then 1`g

TASK MODEL

Fig. 5 A task template thatcommunicates data between thetask and user models. Errorrecovery is initiated via thedecision model of the executivemechanism

250

loop between the two transitions ensures that samples ofthe work environment are taken and monitored at reg-ular intervals and decisions are re-considered at a latertime in transition Decide. The stages of monitoring anddecision-making are performed in cycles as defined bytime intervals (h1, h2) respectively. The decisions con-cern changes in the processing of goals (e.g., interruptionor resumption of goals) and potential recovery of failed,forgotten and upset tasks. Figure 6 shows thatresumption of goals is done in a different manner fromerror recovery of tasks.

When a goal is interrupted, the ‘‘task token’’ visitsbut bypasses all associated tasks and finally exits thetask model and is fed back to transition Decide of theexecutive mechanism. A decision is made with regard tothe appropriate time for resuming the interrupted goaland a new token is sent to the place Resumed_Goals(Fig. 6) and the task model for processing any tasks thatremain incomplete due to interruptions. On the otherhand, failed, forgotten or upset tasks are detected byevaluating information from the global-fusion placesMan_State_List and Task_State_List. A decision issubsequently made with regard to the appropriate timefor recovering these tasks. When colleagues or externalcues remind operators of a forgotten task, a token is sentdirectly to the template of the specific task andinformation is updated in a global-fusion placeSuspended_Tasks_Memory. The same procedure isfollowed for recovering tasks that have failed or havebeen upset by human errors.

4.4 The cognitive user model

The cognitive user model adapts the task network to thechanging work conditions and comprises a set of

modules that address attention management, workloadmanagement, mental tracking of tasks and human reli-ability. The cognitive user model (Fig. 7) consists of fourtransitions that read and write to five global communi-cation places. Each ‘task token’ enters the user model inplace User_Model_In and is added to the queuing placeCandidate_Tasks. In addition, interrupted and deferredtasks are added to the queue of candidate tasks from theplace Suspended_Tasks_Memory. When memory loadexceeds a threshold, some tasks may be forgotten andshed from Suspended_Tasks_Memory. Shed tasks shouldbypass the stages of operator assignment and executionand are put directly at the output of the user model.Transition Recall_Tasks keeps mental tracking of allcandidate tasks while transition Prioritize_Tasks selectstasks according to certain priority criteria.

From the queue of prioritized tasks in placeSelected_Tasks, transition Assign_Tasks selects tasks inorder to assign suitable personnel that should executethem. When the assignment of operators to tasks iscompleted, transition Assign_Tasks produces anotherqueue of tasks in place Active_Tasks that are subse-quently processed in transition Execute_Tasks by theassigned personnel. Transition Assign_Tasks calculatesthe workload of operators and implements a workloadmanagement strategy (e.g., tasks may be done in seriesinstead of parallel or tasks may be assigned to lessbusy operators). Human errors may occur during theexecution stage in transition Execute_Tasks and arecommunicated to place Task_State_List.

4.4.1 Attending tasks in the cognitive user model

Attending tasks involves generating a list of candidatetasks from which certain tasks are selected according to

If gate=on then (g,t)

stm

TASK MODEL

Decide

Man State List

Data

Task organisation

Resumed Goals

Recovered Tasks

RT

SuspendedTasks

Memory

TSL

If gate=on then stm^^[(g,t)] else stm

Decide @+ h1

if pass=on then x

Environment Monitor@+ h2

tsl1 tsl2

msl1 msl2

Task State List

MSL STM

GLOBAL COMMU- NICATION PLACES

Specific task template

Fig 6 The executive mechanismthat monitors the environmentand makes decisions about goalprocessing and error recovery

251

pre-defined criteria (see CPN model in Fig. 8). Transi-tion Recall_Tasks generates a queue of candidate tasksby adding up current tasks and tasks retrieved fromSuspended_Tasks_Memory (i.e., interrupted and de-ferred tasks). The memory activation model (Sect. 3.2)calculates the activation levels of suspended tasks (Eq. 3)and sheds those that are below a threshold. TransitionRecall_Tasks performs this calculation by opening a fileto obtain data about the cost of forgetting and thestrength of external cues for each individual task. Theeffect of workload on mental tracking is taken intoaccount in this calculation by obtaining informationabout the workload of each operator from placeMan_State_List. Shed tasks are sent directly to placeUser_Model_Out while their status is updated in a stackof tasks held in place Task_State_List. The task token inthis module is a pair of two variables (g,t) identifyingthe current goal and task while additional task infor-

mation is held in place Task_State_List. The colour ordata type of this place is shown in the Appendix andcontains additional information that may be needed inother CPN models.

Transition Prioritize_Tasks prioritizes tasks accord-ing to the task constrains, temporal constrains and pri-ority values calculated for each task token (see selectiveattention model, Eq. 1). Data that are stable over therunning of the CPN model are kept in data files con-taining information about the task constraints and thecosts of interrupting tasks. Dynamic data are obtainedfrom places Task_State_List and Man_State_List inorder to calculate a priority index for each candidatetask at the current time frame. Tasks that are notselected at the current time frame are fed back to placeCandidate_Tasks (i.e., condition pass=on evaluates totrue) while the selected task is forwarded to the nextplace Selected_Tasks.

Candidatetasks

RecallTasks

Selectedtasks

PrioritizeTasks

Activetasks

AssignTasks

ExecuteTasks

GLOBAL COMMUNICATION PLACES:Task_State_List, Man_State_List, Man_Char_List, Task_Char_List, Suspended_Tasks_Memory

UserModel In

UserModel Out

Shed tasks

Fig. 7 An overview of the cognitive user model (redescribed in two CPN models in Figs. 8, 9)

stm2

(g,t)

MSL

ts1

stm2

TSL

(g,t)

tsl2 tsl2

tsl1

Prioritize Tasks

(g_out, t_out)

CT Candidate

Tasks

UM_IN

ST Selected

Tasks

Task State List

User Model In

(g,t) Recall Tasks

STM

Suspended Tasks Memory

stm1 stm1

msl

msl msl

msl

If pass=on then (g,t)

Man State List

(g,t,s2,flag,impact)

User Model Out

UM_OUT

Fig. 8 A CPN model forattending tasks that involvespreparing a list of candidatetasks and prioritising tasks

252

4.4.2 Performing tasks in the cognitive user model

Performing tasks involves generating a list of activetasks which are executed according to their time stamp(see CPN model in Fig. 9). Transition Assign_Tasks usesthe algorithm described in Sect. 3.3 in order to assigntasks to operators according to Eq. 4. Task data for thisalgorithm come from global-fusion place Man_Char_-List which logs suitable personnel for each task, andtheir capabilities in terms of accuracy and speed (or taskduration). Therefore, a list of personnel is produced andthe one with the largest assignment score is selected todo the current task. In order to take into account theworkload level of operators, transition Assign_Taskscomputes a workload index. When the workload of theselected operators exceeds a threshold, it is possible tochoose from the workload management strategies inSect. 3.1. For instance, if a serial processing strategy ischosen then the task token would be routed back toplace Selected_Tasks. To estimate the workloadindex, task data are used from global-fusion placeTask_Char_List which keeps a list of records about taskloadings on the perceptual, cognitive and motor chan-nels. Prospective workload is calculated for operatorswho perform other tasks in parallel to the current one;this information about parallel tasks is provided fromglobal-fusion place Task_State_List. Finally, the work-load levels and availability schedule of operators areupdated in global-fusion place Man_State_List (seeAppendix for the data type or colour of all places).

Tasks that have been assigned to an operatorare queued in place Active_Tasks with a time stamp(@+ delay) indicating their starting time and duration.

When this time elapses, the respective task tokens areexecuted by transition Execute_Tasks which also per-forms an analysis of human errors and error conse-quences. Human errors may occur during the executionstage which are communicated to place Task_State_List.Regardless of the degree of success, a task token isproduced in place User_Model_Out to convey informa-tion to the task templates and the task network.

Human errors are induced in the simulation via twomodes or a combination of both: (1) a manualinsertion mode where the designer can manually insertdifferent types of errors in order to assess the impactupon task scheduling and work organization and (2)the error inducing function (EIF) mode where an EIFfunction is used to calculate the effects of workload,fatigues and mental-tracking load upon human reli-ability. The EIF algorithm (adapted from Cacciabueet al. 2003) takes into account the values of theseindices of performance and their weights (or impor-tance) for each action. If the produced EIF valueexceeds a threshold, then an error occurs. Because it isvery difficult to relate the EIF to the error types (i.e.,omission, mistiming and prolongation errors), theseare selected either manually or on the basis of apre-set probability function.

The user model can produce on-line simulations ofomission errors, mistiming, interruptions and delays inthe Execute_Tasks transition and mental-tracking errorsin the Recall_Tasks transition. Other erroneous actionsidentified by Hollnagel (1993), such as reversals,replacements and intrusions, are modelled separately inthe task model as they are related to changes in the tasksequence.

Assign Tasks

Execute Tasks

(g,t,s1,p,a,dur)

msl1

tsl1

TSL

Task StateList

(g,t,s2,flag,impact)

UM_OUTUser

Model Out

tsl1

STM

If s= Interrupted or s= Defered then stm^^[(g,t)]

stm

Suspended Tasks

Memory

MCL

Man Char.List

mcl1

mcl2mcl

mcl

tsl2tsl2

msl2

MSL

Man StateList

msl1

msl2

(g,t)

If s=Default then (g,t)

@+delay2

ST Selected

Tasks

if s<>Default then(g,t,s1,p,a,dur) @+ delay1

AT

Active Tasks

tcl

tcl

TCL

Task Char.List

tsl1

tsl2

Fig. 9 A CPN model forperforming tasks that involvesassigning roles, managingworkload and executing tasks

253

Error consequences can take the following forms:impact on current task (i.e., accuracy and task duration),impact on assigned operator (i.e., increase in workloador change of personnel), side-effects on completed tasks,and inaccessibility to subsequent tasks until problem isresolved. The error consequences can incur eitherimmediately upon task failure or at a later stage whenanother attempt is made to repeat this task. When a taskis interrupted or deferred, an additional token is sent toplace Suspended_Tasks_Memory. When an error occurs,information about failed and upset tasks is posted toplace Task_State_List to be used by the executivemechanism.

5 Analysis modes of the simulation tool

The proposed tool can be used to simulate crew per-formance and examine aspects of system performanceand human reliability. The tool takes different taskdemands as inputs, calculates the PSF (i.e., workload,mental tracking load, and fatigue) and produces severalmetrics of performance (i.e., job duration, job accu-racy, number of interrupted or forgotten tasks, errors).The adverse effects of task demands can be reduced bymanipulating two mitigating factors, that is, workloadmanagement and work organization. The tool affordstwo types of analysis, namely: (1) state space analysisin order to verify the structure and behaviour of thetask network and user model, and (2) simulationanalysis in order to generate data about human per-formance, or validate aspects of the cognitive usermodel.

5.1 State space analysis

The mathematical foundation of Petri nets provides thebasis for using a variety of formal analysis techniquesthat are available in DesignCPN to verify dynamicproperties of the system. It is possible to examine, forinstance, whether the task network contains deadlocks,never-ending tasks, dangling tasks that do not contrib-ute anything, and tasks that are activated unintention-ally resulting in a lack of synchronization. Theseproperties of liveness, boundness and fairness can beinvestigated with formal analysis techniques, such asreachability graphs, state equivalent graphs, and sweep-line techniques.

Basically, each state of the CPN model correspondsto a list of all places and a distribution of tokens in theplaces. A state space consists of a large number of statesthat may be searched and analysed with formal analysistechniques. In the manual insertion mode, the state spaceof the discrete model of the case study ranged between2000 and 5000 states depending on the consequencesof errors and the cycles of monitoring and decision-making. Duration levels of tasks had discrete values

and human errors were inserted manually. This was arelatively small state space with a small number of deadmarkings (i.e., state-nodes), none of which was unpre-dictable. There were no dangling or never-ending tasksand no lack of synchronization.

In the EIF mode, however, the size of state space wasincreased by an order of magnitude when differentprobability values were associated to several error types.It is possible to treat task duration as a stochastic vari-able, however, this increases exponentially the size of thestate space. Equivalent state graphs and the sweep-linetechnique can be used to reduce the size of the statespace but their application was beyond the scope of thestudy. In recent literature, a growing number of studiesare exploring the application of state space analysis tooperational planning using Coloured Petri nets (Petrucciet al. 2002; Kristensen et al. 2002).

5.2 Simulation analysis

The simulation tool can model crew performanceand examine the interaction between task demands,workload-management strategies and work organizationschemes. System performance and human reliability canbe improved by modifying these three factors. Forexample, task demands can be reduced by adjusting theorganization of tasks in the task model, by redesigningtasks (i.e., task duration, task priorities, and externalcues for suspended tasks) and by removing some con-sequences of task failures. On the other hand, operatorscan resort to different strategies for reducing theirworkload and enhancing their reliability. Finally, workorganization schemes can be optimized by changing thetask allocation rules, the task range and the degree ofexpertise of operators. It is also worth noting the inter-action between these factors. For instance, the range ofviable workload strategies may depend on the task de-mands (e.g., it may not be possible to defer tasks orperform tasks in a serial fashion) and on the expertise ofoperators (e.g., higher levels of expertise may reduceworkload or affect the choice of workload strategies).

The simulation tool produces several system andpsychological metrics to assess the impact of changes intask demands, workload strategies and work organiza-tion. System metrics may include accuracy and time toperform the task sequence, state of tasks at any point intime (e.g., interrupted, deferred, shed tasks), theassignment of tasks to operators and time periods whenpreferred operators were unavailable. Psychologicalmetrics may include indices of workload, fatigue andmental tracking load.

6 Application to a case study in process control

To demonstrate the interaction between task demands,workload management strategies and work organiza-

254

tion, two cases have been developed: Simulation Run 1and Simulation Run 2. Two work organization schemeswere evaluated in terms of their impact on system per-formance and human reliability, namely: (1) a serialistwork organization where the supervisor assumesresponsibility for the majority of tasks and (2) a uni-versalist work organization where both operators arecapable of performing most tasks. In general, a serialistorganization achieves higher standards in task accuracybecause of the higher specialization of operators in thetasks they are trained to perform. On the other hand, auniversalist organization can apply a wider range ofworkload management strategies because less busyoperators can undertake a wider range of tasks.

The objective of the case study was to compare thetwo work organization schemes in terms of their po-tential to mitigate the adverse effects of task demands onsystem performance.

The case study refers to a process control taskcomprising fifteen tasks to be performed by a super-visor and an assistant. The normal job included eleventasks grouped into two goals and four contingent tasksgrouped into a third goal to be carried out dependingon a set of emergency conditions. The main part of thejob involves deciding how to allocate tasks between thetwo operators so that goals 1 and 2 are carried out inparallel for most of the time. The task network(Fig. 10) shows the pre-conditions for initiating tasks(e.g., task 3 should start when tasks 1 and 2 arecompleted). The allocation of tasks to operators isperformed in transition Assign_Tasks (Fig. 9) whichtakes into account a set of global and local allocationrules, the skills of operators in terms of speed andaccuracy, and the workload of operators. The super-visor is responsible for monitoring the plant conditionson a control panel and makes decisions on how to copewith emergent events.

In the current scenario, an emergent event requires aprompt response by initiating recovery goal 3 and tem-porarily suspending goal 1 or goal 2. The suspended goal1 or 2 can be resumed, once tasks 12 and 13 of goal 3(Fig. 10) have been performed successfully. Monitoringthe control panel and making decisions on how to copewith emergent events or human errors are activities as-signed to the supervisor, which can increase his or herworkload. For the purpose of the case study, perfor-mance decrements and errors have been determinedmainly by operator workload.

7 Simulation Run 1: A serialist work organization

In the serialist organization, there is a high degree ofspecialization where the assistant is capable of per-forming only half of the required tasks (i.e., tasks 3, 5, 6,9, 11, 14, 15) but to a higher standard of task accuracythan the supervisor who can perform all tasks. Theoperator with the higher assignment score is first as-signed to each task but this policy occasionally creates

high workload levels. Because of the serialist organiza-tion, however, it is not always possible to reassign tasksto the other operator due to lack of expertise. Potentialworkload management strategies include: resorting toserial rather than parallel processing, deferring the newtask, and interrupting ongoing tasks in favour of new

Goal 3 Goal 2

T1 T2 T7

T3

T6 T11

T9

T8

T14

T15

T13T12

Start

Goal 1

End

Fig. 10 The task model of the case study comprising 15 tasksorganized into goal 1, goal 2 and the recovery goal 3

Fig. 11 A task timeline in the serialist organization showing taskallocation to the supervisor (S) and the assistant (A)

255

tasks. When task demands preclude the application ofsuch strategies, human performance may deteriorateresulting in lower standards of accuracy or human er-rors.

Simulation Run 1 produces a task timeline with theassigned operators (Fig. 11) and a workload trace ofoperators (Fig. 12). The workload of the supervisorbecomes very high in the interval 10–20 as s/he has toperform tasks 1, 2, 7 and 8 in parallel. The reason is thatit is not possible to allocate any of these tasks to theassistant (i.e., lack of expertise) nor it is possible to defernew tasks or interrupt ongoing tasks (i.e., high taskdemands). The high workload results in an error, thatis, the supervisor fails to perform task 8 correctly.Hence, s/he has to repeat both tasks 7 and 8 at sometime in future since the two tasks should be executed inparallel. When this time comes (40–50), tasks 7 and 8 areexecuted correctly but coincide with performance oftasks 4 and 10. Supervisor workload increases again andthe only viable strategy is to defer either task 4 or task10. At this point, the scenario simulated the decision ofthe supervisor to perform all tasks in parallel which re-sulted in failing to perform task 10 correctly. This is aworst case scenario in comparison to a scenario based ondeferring tasks 4 or 10.

A few minutes later (65), the supervisor detects anabnormal event and orders that the recovery goal 3 isinitiated. Because only two goals can be processed at atime, goal 1 is suspended while goal 2 is revisited toexecute task 10. Parallel processing of tasks 10, 12 and13 leads to high workload (at time interval 85) and thesupervisor decides to defer task 10 in favour of recoverygoal 3 (Fig. 12). When task 10 is performed correctly,the operators resume goal 1 and perform the remainingtasks 5 and 6. In the recovery stage of the scenario, theworkload of the supervisor is always below the thresholdvalue (150) since the assistant is competent in perform-ing tasks 5, 6, 14 and 15.

7.1 Simulation Run 2: A universalist work organization

In the universalist organization, there is a low degreeof specialization where both operators can perform all

tasks but at a lower level of task accuracy than theserialist organization. The operator with the higherassignment score is first assigned to the task but thispolicy is modified when the most competent opera-tor has a high workload level. In this sense,workload is kept under the specified threshold value(150).

Simulation Run 2 produces a task timeline with theassigned operators (Fig. 13) and a workload trace ofoperators (Fig. 14). The workload of the supervisorbecomes quite high in the interval 10–20 as s/he has todecide whether to perform tasks 1, 2, 7 and 8 in parallelor not. To reduce the high workload, the supervisorassigns tasks 1 and 2 to the assistant who executes themin parallel as specified in the task network. Tasks 3 and 9are assigned to the assistant while tasks 4 and 10 areassigned to the supervisor according to their assignmentscores. Goal 2 is completed when the assistant performstask 10.

A few minutes later (65), the supervisor detects anabnormal event and orders that the recovery goal 3 isinitiated. Because only two goals can be processed at atime, goal 1 is suspended since goal 2 has already beencompleted. When tasks 12 and 13 of the recovery goal 3

Workload Distribution - Serialist Organisation

0

50

100

150

200

250

300

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

S

A

Fig. 12 A trace of the workloadof the supervisor (S) and theassistant (A) in the serialistorganization (workload valuesabove 150 may result in errors)

Fig. 13 A task timeline in the universalist organization showingtask allocation to the supervisor (S) and the assistant (A)

256

have been performed, the operators resume goal 1 andperform the remaining tasks 5 and 6. In Simulation Run2, the workload of both operators was always keptbelow the threshold since they were both capable ofperforming all tasks.

7.2 Comparison of simulation runs

The results of the case study show that the universalistorganization is a more flexible work scheme for thisapplication because it can deal better with periods ofhigh workload than the serialist one. The high work-load of the supervisor in the serialist organization gaverise to two human errors that were recovered success-fully at later periods of time. As a result, the total taskduration in the serialist organization (t=150) waslonger than the universalist one (t=130). However,these benefits of the universalist organization have tobe traded-off against task accuracy. The wider taskrepertoire of operators in the universalist organizationimplies fewer opportunities for practice and loweraccuracy scores than the ones found in the more spe-cialized organization. The analysis showed that theaccuracy score in the universalist organization wasapproximately 20% lower than the one reported in theserialist organization. The case study illustrates thatworkload management strategies and work organiza-tion are two important mediating factors in the impactof task demands upon human performance. Anassumption was made that operators in the universalistorganization could perform individual tasks withouterrors (i.e., lack of practice would affect task accuracyonly) and that they would be able to use a range ofworkload management strategies. Different resultscould be obtained by experimenting with differentassumptions about these mediating factors (e.g., Zulchet al. 2003).

The results also indicated that the most critical taskdemand was the requirement to perform tasks 1 and 2in parallel to tasks 7 and 8. In the serialist organiza-tion, this resulted in high workload because the

supervisor could not defer or perform them in serialand neither could s/he assign some of them to theassistant who was specialized in other tasks. Somegeneral recommendations for improving human reli-ability in the case study may include:

(i) Reduce task demands by redesigning the job tominimize the need for parallel processing or minimizethe consequences of task failures,

(ii) Reduce workload in parallel processing of tasks 1, 2,7 and 8 by automating parts of the job, simplifyingthe job or training operators to over-learn responses,and

(iii) Change work organization so that the assistantacquires a wider repertoire of skills.

It is worth noting that all recommendations regardhuman factor interventions in transitions Assign_Tasksand Execute_Tasks (Fig. 9). Interventions in the cueingfeatures of tasks, priorities of tasks and consequences ofsuspending tasks (i.e., transitions Recall_Tasks andPrioritize_Tasks, Fig. 8) were not applicable in thepresent case study.

8 Conclusions

The simulation tool has been developed to serve therequirement of integrating task networks with usercognitive models. Task networks can generate severalperformance metrics but cannot cope with variations injob design, such as modifications to job procedures, goalpriorities and task allocation. Integrating task networkswith cognitive models allows designers to use severalsystem and psychological metrics (i.e., duration andaccuracy scores, indices of workload and fatigue) as wellas model how crew performance can be adapted tochanging circumstances (i.e., mental tracking of sus-pended tasks, coping with interruption and reallocationof tasks, and managing workload). Hence, adapting tojob variations and recovering from early unsuccessfulattempts becomes the basis of job design for safety andproductivity.

Workload Distribution - Universalist Organisation

0

50

100

150

200

250

300

0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 190 200

S

A

Fig. 14 A trace of the workloadof the supervisor (S) and theassistant (A) in the universalistorganization

257

An important feature of the simulation tool is thathuman performance is examined within the widercontext of work. For instance, the performance of atask is also affected by the state of other operationaltasks (i.e., candidate, suspended and failed tasks) andthe state of mental activities of operators (i.e., moni-toring events, mental tracking, dividing attention andmanaging workload). As a result, specific recommen-dations can be derived for improving productivity andreliability by means of changes in task demands,workload strategies and work organization. The simu-lation tool is currently under development in order toaddress three broader issues: - the validity of cognitivemodels, the mechanisms of user models that affecthuman reliability, and the validity of information usedin task modelling.

In order to obtain valid results, user models shouldbe valid models of the interaction between cognitionand work. In this sense, the models of selectiveattention and work organization are preliminarymodels that have not been validated in the context ofreal task scenarios. On the other hand, the models ofdivided attention and memory management have beenvalidated in the literature (Wickens et al. 1988; Altmanand Trafton 2002) in diverse applications (i.e., airtraffic control, aircraft control, and human computerinteraction) but it is difficult to ascertain the extentthat the findings can transfer to process control tasks.Empirical studies are, therefore, needed to validate theutilized user models in the context of process control.However, it is anticipated that simulation is, by itself,a useful tool in comparing simulated user models toempirical data. Future developments of the cognitiveuser model of the simulation tool should proceed inthis direction.

Another issue concerns the mechanisms of the cog-nitive user model that influence human reliability. At thepresent stage of development, the simulation tool as-sumes that human errors arise as a result of a set of PSF(e.g., workload, fatigue, mental tracking load) collec-tively exceeding a threshold. However, human perfor-mance is flexible and operators may avoid an error byreducing the requirements of performance (e.g., performa task to a lower degree of accuracy). Therefore, it isdifficult to determine whether high PSF levels will giverise to human errors or performance decrements. Inaddition, it is not possible to determine the types of errorthat may be the result of high task demands. The sim-ulation tool should be mainly used to compare differenttask demands and identify worst case scenarios that af-fect system performance rather than as a representationof cognitive processes along the lines of Yoshikawa et al.(1997).

The issue of data and information of the user modelsor algorithms is another major concern. At present, the

simulation uses rather arbitrary values for many of thevariables regarding task attributes (e.g., temporal andsequence attributes), ratings on the information pro-cessing channels, external cues associated with sus-pended tasks, error consequences, deadlines associatedwith competing tasks and so on. These data are specificto the nature of the application tasks and should beacquired by means of field observation and experimen-tation. A number of empirical studies are required inorder to collect data that can be used to calibrate thevariables and thresholds of the algorithms of the cog-nitive user model. This is necessary in order to use thesimulation to make predictions about human perfor-mance in new tasks.

When these validity issues are resolved, the simula-tion tool can be used to redesign jobs and teams in orderto increase productivity and reliability. Designers maybe able to verify operating procedures for a wide rangeof job variations and identify critical task demands thatcould give rise to human errors. Job design can alsobenefit from the simulation tool by redesigning taskfeatures to reduce workload, introducing additional cuesfor tasks, and changing adverse consequences arisingform suspended or failed tasks. Finally, strategies formanaging workload, changing goal priorities and re-scheduling tasks can form the basis for new trainingschemes.

From a computer science viewpoint, CPN and itsStandard ML language were a useful modelling platformfor procedural tasks. DesignCPN, however, may runinto difficulties when modelling reactive systems inwhich monitoring certain events takes priority overothers. The lack of ‘‘priority’’ transitions makes mod-elling of certain tasks rather cumbersome (e.g., moni-toring events and performing tasks at the same time). Inaddition, the modelling of interrupting events is inade-quate since tasks or transitions cannot be literallyinterrupted once execution has started. Interrupting atask, which has already been on progress, would requirea change of the time model of DesignCPN towards‘‘augmented time’’ models advocated by Zhou andVenkatesh (1998). Further improvements in the archi-tecture of Petri nets would provide additional featuresfor modelling the temporal dynamics of complex sys-tems.

There is little doubt that computational modellingefforts may require extensive resources in terms ofdata, expertise and time. However, modern systemsrequire an increasing degree of flexibility in schedulingand adaptation of job procedures to the changingwork conditions. The proposed simulation tool offersa platform for modelling system performance andhuman reliability with a similar modelling languagethat is amenable to both simulation and formalanalysis.

258

9 Appendix

Selected declaration of colours or data types used in the CPN models colour INT = integer; colour Delay = INT; colour Data, ID = INT; colour Goal, Task = INT; colour Accuracy, Duration = INT; colour Person = with None | All | Supervisor | Assistant ; colour PAD = product Person * Accuracy * Duration ; colour Flag = with Up | Down; (* when goal is interrupted, the flag is down*) colour Impact = with Locked | Unlocked; (* side-effects of task failures *) colour Pass, Gate = with on | off;colour State = with Default | Started | Done | Deferred | Upset | Shed | Failed | Interrupted;

colour UM_IN = product Goal * Task, colour UM_OUT= product Goal * Task * State * Flag * Impact ; colour CT, ST, RT = product Goal * Task; colour AT = product Goal * Task * State * Person * Accuracy * Duration ;

colour ManChar = record tid:INT * (* task identification number *) eff: list PAD; (* list of tuples of type PAD *)

colour TaskChar = record gid:INT* (* goal identification number *) tid:INT* (* task identification number *) P:INT* (* loading on perception channel *) C:INT* (* loading on cognitive channel *) M:INT; (* loading on motor channel*)

colour ManState = record name:Person * (* name of person participating in the job*) avahr:INT * (* time that this person becomes available again*) work:INT; (* current level of workload)

colour TaskState = record tid:INT * (* task identification number *) pri:INT * (* default priority number of task *) flag : Flag * (* status of associated goal Up or Down *) person:Person * (* person assigned to perform the task *) status:State * (* status of task at current time *) tb:INT * (* time that task started *) te:INT ; (* time that task ended *)

colour STM = list ST; colour TSL = list TaskState ; colour MSL = list ManState; colour MCL = list ManChar; colour TCL = list TaskChar ;

(* Global Fusion places: Suspended_Tasks_Memory, Recovered_Tasks, UM_IN, UM_OUT, Task_State_List, Man_State_List, Man_Char_List, Task_Char_List *)

References

van der Aalst WMP, Hofstede AHM (2002) Workflow patterns: onthe expressive power of (Petri nets based) workflow languages.In: Jensen K (eds) Proceedings of the fourth workshop on the

practical use of coloured Petri nets and CPN tools, Departmentof Computer Science, University of Aarhus, Denmark, vol 560,pp1–20

Abed M, Tabary D, Kolski C (2003) Using formal specificationtechniques for modelling tasks and generation of HCI specifi-cations. In: Diaper D, Stanton N (eds) The handbook of task

259

analysis for human computer interaction Chapter 30. LawrenceErlbaum Associates, Mahwah, pp. 503–529

Altman EM, Trafton JG (2002) Memory for goals: an activation-based model. Cogn Sci 26:39–83

Blom HAP, Daams J, Nijhuis HB (2000) Human cognition mod-elling in ATM safety assessment. In: Proceedings of the 3rdUSA/Europe AirTraffic Management R & D Seminar, Napoli,13–16 June 2000

Cacciabue PC (1998) Modelling and simulation of human behav-iour in system analysis. Springer, Berlin Heidelberg New York

Cacciabue PC, Mauri C, Owen D (2003) The development of amodel and simulation of an aviation maintenance technicianperformance. Cogn Technol Work 5:229–247

Card SK, Moran TP, Newell A (1983) The psychology of humancomputer interaction. Lawrence Erlbaum Associates, Mahwah

DesignCPN version 4.0, Meta Software Corporation. CambridgeMA. Also available from the Department of Computer Sci-ence, University of Aarhus at http://www.daimi.au.dk/De-signCPN

Embrey DE, Kontogiannis T, Green M (1994) Guidelines forpreventing human error in process safety Center for Chemicalprocess safety. American Institute of Chemical Engineers, NewYork

Freed M (1998) Managing multiple tasks in complex, dynamicenvironments. In: Proceedings of the 15th national conferenceon artificial intelligence, AAAI Press/MIT Press, Madison/Wiscosin. pp. 921–927

Freed M (2000) Reactive prioritization. In: Proceedings of the 2ndNASA international workshop on planning and scheduling inspace, March 2000. San Francisco

HandleyHAH, Levis AH (2003)Modelling for future command andcontrol architectures. In: Proceedings of the 8th internationalcommand and control research and technology symposium,National Defense University, Washington DC, 17–19 June 2003

Handley HAH, Zaidi ZR, Levis A (1999) The use of simulationmodels in model-driven experiments. Syst Eng 2(2):108–128

Hendy KC, Farrell PS (1997) Implementing a model of informa-tion processing in a task network simulation environment(DCIEM 97-R-71). Defense and Civil Institute of Environ-mental Medicine, Ontario, Canada

Hollnagel E (1993). Human reliability: context and control. Aca-demic, London

Jensen K (1997a) Coloured Petri nets: basic concepts, analysismethods and practical use. vol 1: basic concepts. Monographs intheoretical computer science, Springer, Berlin Heidelberg NewYork

Jensen K (1997b) Coloured Petri nets: basic concepts, analysismethods and practical use. Vol 2: analysis methods. Mono-graphs in theoretical computer science, Springer, Berlin Hei-delberg New York

John BE, Kieras DE (1996) The GOMS family of user interfacesanalysis techniques: comparison and constructs. ACM TransComput Hum Interact 3(4):20–351

Kirwan B, Ainsworth LK (1992) A guide to task analysis. Taylor &Francis, London

Kjellen U (2000) Prevention of accidents through experiencefeedback. Taylor & Francis, London

Kletz TA (1991) An engineer’s view of human error, 2nd edn.Institution of Chemical Engineers, Rugby

Kontogiannis T (2003) A Petri-net based approach for ergonomictask analysis and modelling with emphasis on adaptation tosystem changes. Saf Sci 41:803–835

Kristensen LM, Mitchell B, Zhang L, Billington J (2002) Modellingand initial analysis of operational planning processes usingcoloured Petri nets. In: Proceedings of workshop on formalmethods applied to defence systems, conference in research andpractice in information technology, Australian ComputerSociety, vol 12, pp105–114

Lacaze X, Palanque P, Bastide R (2002) Performance evaluationsas a tool for quantitative assessment of complexity of interac-tive systems. Lecture Notes in Computer Science, SpringerVerlag, No 2545, pp 208–222

Laughery KR, Corker KM (1997) Computer modelling and sim-ulation of human-system performance. In: Salvendy G (ed)Handbook of human factors and ergonomics, 2nd edn. Wiley,New York, pp 1375–1408

Lebiere C, Biefeld F, Archer S, Allender L, Kelley TD (2002)IMPRINT/ACT-R: integration of a task network architecturewith a cognitive architecture and its application to humanerror modelling. In: Chini MJ (ed) Military, government andaerospace simulation, Society for Modelling and SimulationInternational, San Diego 34(3):13–19

Levenson N, Stolzy (1987) Safety analysis using Petri nets. IEEETrans Software Eng 13:386–397

Lindsay P, Connelly S (2002) Modelling erroneous operatorbehaviours for an air traffic control tasks. In: Grundy J, CalderP (eds) Third Australian user interface conference, AustralianComputer Society Inc, vol 7, pp 43–54

Lockett JF (1997) Task network modelling of human workloadcoping strategies. In: Smith MJ, Salvendy G, Koubek RJ (eds)Design of computing systems: social and ergonomic consider-ations, proceedings of the seventh international conference onhuman–computer interaction, (HCI International ‘97). Elsevier,San Francisco vol 2, pp 71–74

Lovett MC, Daily LZ, Reder LM (2000) A source activation theoryof working memory: cross task prediction of performance inACT-R. J Cogn Syst Res 1:99–118

Moher T, Dirda V (1995) Revising mental models to accom-modate expectation failures in human–computer dialogues.In:2nd DSVIS workshop on design, specification and verificationof interactive systems, Speringer, Berlin Heidelberg NewYork

Mori G, Paterno F, Santoro C (2002) CTTE: support for devel-oping and analyzing task models for interactive system design.IEEE Trans Software Eng 28(9):1–17

North RA, Riley VA (1989) A predictive model of operatorworkload. In: McMillan GR, et al (eds) Applications of humanperformance models to system design. Plenum Press, New Yorkpp 81–90

Palanque P, Bastide R (1997) Synergistic modelling of tasks, usersand systems using formal specification techniques. InteractComput 9(2):129–153

Petrucci L, Kristensen LM, Billington J, Qureshi Z (2002) Towardsformal specification and analysis of avionics mission systems. In:Proceedings of conference in research and practice in informationtechnology, Workshop on formal methods applied to defensesystems, Australian Computer Society, vol 2, pp 95–104

Pew RW, Mavor AS (1998) Modelling human and organizationalbehaviour: application to military simulations. NationalAcademy Press, Washington, DC

Rauterberg M (1993) AMME: an automatic mental model evalu-ation to analyze user behaviour traced in a finite, discrete statespace. Ergonomics 36:1369–1380

Shepherd A (2001) Hierarchical task analysis. Taylor & Francis,London

Schlick C, Reuth R, Luczak H (2002) A comparative simulationstudy of work processes in autonomous production cells. HumFactors Ergon Manuf 12(1):31–54

Stanton N, Young MS (1999) A guide to methodology in ergo-nomics. Taylor & Francis, London

Stutz P, Onken R (2001) Adaptive pilot modelling for cockpit crewassistance: concept, realization and results. In: Proceedings ofthe 8th conference on cognitive science approaches to processcontrol. The cognitive work process: automation and interac-tion. Munich, 24–26 September 2001

Tarby JC, Barthet MF (1996) The DIANE+ method. In: Van-derdonckt J (ed) Proceedings of the 2nd international work-shop on computer aided design of user interfaces (CADUI’96). Presses Universitaires de Namur, Narmur, vol 15, pp 95–120

Uhr H (2003) TOMBOLA: simulation and user-specific presen-tation of executable task models. In: Jacko J, Staphanidis C(eds) Human computer interaction: theory and practice (PartI). Lawrence Erlbaum Associates, Mahwah, pp 263–267

260

Wickens CD, Harwood K, Segal L, Tkalcevic I, Sherman B (1988)TASKILLAN: A simulation to predict the validity of multipleresource models of aviation workload. In: Proceedings of the32nd annual meeting of the human factors society. HumanFactors Society, Santa Monica, pp 168–172

Yoshikawa H, Nakagawa T, Nakatani Y, Furutra T, Hasegawa A(1997) Development of an analysis support system for man-machine system design information. Reliability Eng Syst Saf5(3):417–425

Zachary W, Campbell G, Laughery R, Glenn F (1998) Applicationof human modelling technology to the design, operation and

evaluation of complex systems Technical Memo No980727.9705. CHI Systems, Inc., Lower Gwynedd, PA

Zhou M, Venkatesh K (1998) Modelling, simulation and control offlexible manufacturing systems: a Petri net approach. WorldScientific, New Jersey

Zulch G, Kruger J, Schindele H, Rottinger S (2003) Simulation-aided planning of quality-oriented personnel structures in pro-duction systems. Appl Ergon 34:293–301

261